formbook

General

Target

16fcfaa35b847c585a964a7e862e7321e71ec098eaf6d6a33721cf113ddb159f
Size

1.1MB
Sample

241209-ygltnatnhm
MD5

dd8249ab4c9e8a8e4aac3290a2fbad2a
SHA1

75f7fd605e1d035e04649a3d865ef8d8ca713e63
SHA256

16fcfaa35b847c585a964a7e862e7321e71ec098eaf6d6a33721cf113ddb159f
SHA512

304a81717dc609b924b921186c43a50f257502d6729b196f8e7341d324e56267e58a3a055b2b279ca269060b020022f154b86555f60666a9a6f8cc3add38925b
SSDEEP

24576:bu6J33O0c+JY5UZ+XC0kGso6FaduI4+K0vJWY:Vu0c++OCvkGs9Faduv108Y

Score

10^/10

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

at22

Decoy

etween-us.online

sphaleia.net

ental-implants-78350.bond

q4a.lat

commerce-97292.bond

linds-curtains-38811.bond

gyptevoyages.net

landofigueroa-abogados.net

cuitis.xyz

hantom.city

yzk.online

afikabmedan.store

ome-remodeling-67289.bond

ebpage-klzdxrhnazi.shop

eject.lol

rismart.xyz

nfluencer-marketing-72407.bond

ksolotl.xyz

ebsbayrntilrmizin93.xyz

pps-75399.bond

Targets

- Target
  
  16fcfaa35b847c585a964a7e862e7321e71ec098eaf6d6a33721cf113ddb159f
- Size
  
  1.1MB
- MD5
  
  dd8249ab4c9e8a8e4aac3290a2fbad2a
- SHA1
  
  75f7fd605e1d035e04649a3d865ef8d8ca713e63
- SHA256
  
  16fcfaa35b847c585a964a7e862e7321e71ec098eaf6d6a33721cf113ddb159f
- SHA512
  
  304a81717dc609b924b921186c43a50f257502d6729b196f8e7341d324e56267e58a3a055b2b279ca269060b020022f154b86555f60666a9a6f8cc3add38925b
- SSDEEP
  
  24576:bu6J33O0c+JY5UZ+XC0kGso6FaduI4+K0vJWY:Vu0c++OCvkGs9Faduv108Y
Score

10^/10

formbook at22 discovery rat spyware stealer trojan
- Formbook
  Formbook is a data stealing malware which is capable of stealing data.
  trojan spyware stealer formbook
- Formbook family
  formbook
- Formbook payload
  rat
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Formbook family

Formbook payload

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2